magpie-security-issue-invalidate

name	magpie-security-issue-invalidate
family	security
mode	Triage
description	Close an `<tracker>` tracking issue as invalid: apply the `invalid` label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported from `<security-list>` — draft a polite-but-firm reply to the reporter on the original Gmail thread explaining the team's reasoning (extracted from the tracker's discussion). For trackers opened via `security-issue-import-from-pr`, the email-draft step is skipped per the *no outreach to the PR author* rule of that skill.
when_to_use	Invoke when a security team member says "close NN as invalid", "invalidate NN", "mark NN invalid", "NN is not a security issue" — typically after a consensus-invalid decision in the issue's discussion. Skip when the team has not yet reached consensus, when a CVE has already been allocated (a separate Vulnogram REJECT flow runs first), or when the advisory has already shipped — closing as invalid then is a retraction with public consequences and warrants explicit team escalation.
argument-hint	[issue-number]
capability	capability:resolve
license	Apache-2.0

security-issue-invalidate

This skill is the terminal-disposition apply step for the invalid close on an <tracker> tracker. It does not host the discussion that decides invalidity — that happens at Step 5 of the handling process in the tracker's comments. Once the team has reached a consensus-invalid decision, this skill applies it: labels the tracker invalid, posts a short public-facing closing comment, closes the tracker, archives the project-board item, and (for security@-imported trackers) drafts a reply to the reporter explaining why.

It is the symmetric counterpart of security-cve-allocate (apply step for the valid → CVE path). Both skills assume the validity decision has already been reached; they wire that decision into the tracker state in one pass.

Golden rule — never sends email. Any reply to the reporter is created as a Gmail draft on the original inbound thread. The triager reviews the draft in Gmail before sending. The skill must not call send on any drafting backend.

Golden rule — public-facing comment is brief. The closing comment posted on the public-by-collaborator-access tracker is short and process-shaped ("closing as invalid per team consensus in this thread"); the team's full reasoning lives in the discussion comments and the rollup. The detailed reasoning belongs in the email draft to the reporter (where it actually serves a purpose), not in a closing comment that re-packages the same material.

Golden rule — no outreach to PR-imported tracker authors. When the tracker came in via security-issue-import-from-pr (detected by the N/A — opened from public PR … sentinel in the Security mailing list thread body field), there is no reporter to notify — the PR author is not the CVE reporter and the public PR stays unaware of the CVE process per that skill's policy. Skip the email-draft step entirely; do not comment on the public PR; do not reach out to the PR author through any channel.

Golden rule — every <tracker> / <upstream> reference is clickable in the surface it lands on. Whenever this skill emits a reference to the tracker issue, a sibling tracker, or any cited PR — the closing comment posted on the tracker, the draft email reply to the reporter on the <security-list> thread, the recap output — the reference must be one click away in whatever surface it lands on: